General
-
Target
abdd0f2a8e6d77d60832f489ee545a7c36aa03ec5ea9fa2da2a5bd01020bb097
-
Size
362KB
-
MD5
786043242d353a0cce4c52d5e2598ac9
-
SHA1
385dde306d0211af875517e27a5fb1b1b93d2b95
-
SHA256
abdd0f2a8e6d77d60832f489ee545a7c36aa03ec5ea9fa2da2a5bd01020bb097
-
SHA512
5399af18fad0ce43d91a870fd1a70d6346b309b73f3e0b2fce6d180dacc158e1e0e5a164790678aefa6b7db21a150c6c2b2b8b528e382546ee4880a86d710365
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
abdd0f2a8e6d77d60832f489ee545a7c36aa03ec5ea9fa2da2a5bd01020bb097.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ